| Package | Affected versions | Patched versions |
|---|---|---|
| payload | = 4.0.0< 3.90.0 | 3.90.0 |
| @payloadcms/plugin-multi-tenant | ≥ 4.0.0-canary.0, < 4.0.0-canary.34< 3.90.0 | 4.0.0-canary.343.90.0 |
When using the default tenant array field access, an authenticated user could assign themselves to other tenants.
You are affected if:
@payloadcms/plugin-multi-tenantIf you configure the tenants arrayFieldAccess.create/update functions, a secured replacement membership field, you are not affected by this specific default behavior.
Users should upgrade Payload packages to >= 3.90.0 or >= 4.0.0-canary.34.
Configure tenants arrayFieldAccess.create and tenants arrayFieldAccess.update so only trusted users authorized for all tenants can modify memberships.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free